TaskForce SAS/SATA/IDE/USB/10Gb HDD Forensic
Welcome to an insightful journey into Atola TaskForce, an impressive forensic imager that combines high performance, extensive capabilities, and user-friendly interface. The Atola TaskForce is designed for both working professionals dealing with undamaged media and experts facing the challenges posed by damaged media.
Exceptional Hardware and Software Capabilities
At its core, the TaskForce comprises a hardware unit and a user-friendly software platform accessible via Google Chrome. It operates in standalone mode and also supports simultaneous use by multiple operators within the same local network. Thanks to its web API, it facilitates automation of forensic imaging, paving the way for subsequent analysis with software like Magnet AXIOM, X-Ways, and Autopsy.
The Extensive Support for Storage Devices
The TaskForce's support for storage devices is notably extensive, accommodating SAS, SATA, USB, and IDE drives through 18 ports. Plus, other devices are catered to via Thunderbolt, Apple PCIe, and M.2 SSD extension modules. With such versatility, no storage device will be left uninvestigated. Click here to review the List of hard drives and other devices supported by Atola TaskForce
Unparalleled Imaging Capabilities
The Atola TaskForce isn't just about compatibility; it's about performance. With the ability to manage over 12 simultaneous imaging sessions, it's a powerhouse in the forensic market.
Performance Metrics:
-
-
Speed: A staggering 15 TB/hour cumulative imaging speed.
-
Connectivity: Equipped with 2 x 10Gb Ethernet ports for swift data transfers.
-
Flexibility: Source/target switch on all ports, ensuring data integrity and ease of operation.
-
Security: Hardware write protection in Source mode on all ports, safeguarding evidence from potential tampering.
-
Multiple Imaging Options: Allows imaging to up to 5 targets, with physical imaging to E01, AFF4, and RAW files, and logical imaging to L01 files.
-
Express Mode: A unique feature where imaging sessions commence immediately upon device connection, saving crucial time.
-
Automation: Seamless integration with Web API for automated operations.
-
RAID Configuration Autodetection and Imaging
One of the standout features of the Atola TaskForce is its ability to detect and image RAID configurations, even when their setup is unknown.
RAID Imaging Features:
-
-
Identification: Uses data parsing on connected drives and/or image files for RAID identification.
-
Supported RAID Types: Comprehensive support for RAID 0, 1, 5, 10, and JBOD.
-
File System Compatibility: Works with NTFS, ext4/3/2, XFS, exFAT, APFS, HFS/HFS+, FAT32/16, and more.
-
Software and Hardware RAID: Recognizes software RAID created by mdadm and hardware RAID controllers from leading brands like Adaptec, Areca, HP, Dell, LSI, Intel RST, IBM ServeRAID, and other generic controllers.
-
Instant Identification: Especially for mdadm-created RAID, ensuring swift operations.
-
User-Friendly Interface: One-click application of a suggested configuration and partition preview for ease of use.
-
RAID Rebuild: Ability to rebuild RAID with a missing or damaged device, especially for redundancy-enabled RAID types.
-
Vast Configurations: Can auto-check up to 100,000,000 RAID configurations.
-
Imaging Flexibility: Allows imaging of the entire RAID array or individual partitions based on the investigator's requirements.
-
Commitment to Excellence
Atola stands firmly behind the TaskForce. Should the hardware unit malfunction, users are covered by a lifetime warranty as long as their subscription remains active. This subscription also includes 2-3 software updates annually, ensuring that users always have access to the latest features and improvements.
Damaged Drive Support: Maximizing Data Retrieval
When dealing with damaged or problematic storage devices, the challenges are manifold. The Atola TaskForce, however, is engineered to confront these challenges head-on, ensuring that investigators can retrieve as much data as possible, even from the most compromised drives.
Features Tailored for Damaged Drives:
-
-
Selective Imaging: TaskForce can image data exclusively from functional heads, bypassing damaged ones.
-
Handling Freezing Drives: It's equipped to image drives that freeze, ensuring that intermittent functionality doesn't hinder data retrieval.
-
Addressing Surface and Firmware Issues: TaskForce can image drives with surface scratches and firmware problems, expanding its range of operability.
-
In-depth Diagnostics: Before imaging, the device performs a comprehensive diagnostic of the drive to determine the best imaging strategy.
-
Adaptive Imaging: Users can pause and resume imaging sessions, tweaking settings on-the-go to optimize data retrieval.
-
Safety Measures: With a current sensor on all SATA, SAS/SATA, and IDE ports, and automatic overcurrent and short-circuit protection, TaskForce ensures that the imaging process is safe for both the drive and the device.
-
Moreover, the TaskForce hardware boasts full circuit protection. This means that even if a malfunctioning storage device is connected, it won't cause damage to the TaskForce or exacerbate its own issues.
Multi-user Access: Seamless and Intuitive
UI Highlights:
-
-
Browser-based Operation: Users can operate the unit via the Chrome browser, ensuring easy access and familiarity.
-
Multi-user Functionality: Multiple users can operate the device simultaneously, promoting collaborative investigations.
-
Efficiency: Most operations can be launched within just a few clicks or taps.
-
Intuitive Design: The task-oriented user interface ensures that users can navigate and operate the device with ease.
-
Three Ways to Manage TaskForce
Whether in a lab or out in the field, TaskForce offers three distinct connectivity options to suit every investigative scenario:
-
-
10Gb Ethernet Network: Any device within the same local network can access TaskForce by simply entering its IP address in Google Chrome. The IP address is conveniently displayed on the front panel screen. This mode supports features like two 10 Gbit Ethernet ports, dynamic/static IP addressing, secure connections to password-protected folders, DFS support, and HTTPS connectivity with both organizational and self-signed certificates.
-
Standalone Mode: TaskForce's compact size, combined with its standalone mode, makes it a formidable tool for fieldwork. The built-in touch screen ensures that users can operate the device without needing any additional computers.
-
Remote Wi-Fi Connection: By supplementing TaskForce with a WiFi 802.11n 150 Mb/s adapter, users can set up a secure network for remote control via various devices, from laptops to smartphones.
-
Additional Features: Elevating Forensic Imaging
TaskForce isn't just about imaging. It's a comprehensive forensic tool with a range of features:
-
-
Data Wiping: Supports various methods like Pattern, Secure Erase, NIST 800-88, DoD 5220.22-M, Random, and LBA number.
-
File Browsing: Users can browse files on any connected device directly.
-
SMART Analysis: View and record SMART data before and after image acquisition to assess drive health.
-
Hash Calculation: Supports multiple algorithms including MD5, SHA1, SHA256, and SHA512.
-
HPA & DCO Management: Control and recover Hidden Protected Areas and Device Configuration Overlays.
-
Reporting: Automatic report generation ensures that investigators have a detailed record of their operations.
-
Case Management: An integrated system to manage and organize forensic cases efficiently.
-
The Atola TaskForce forensic imager is more than just a device; it's a holistic solution for digital forensic experts. Whether dealing with damaged drives, collaborating with a team, or managing cases, TaskForce is designed to deliver results with precision, safety, and efficiency. As digital evidence continues to play a pivotal role in modern investigations, tools like TaskForce are indispensable in ensuring that no byte is left unexamined.
Forensic Technology Hardware
Constructed to facilitate numerous simultaneous imaging sessions and other forensics-related operations across its 18 ports at peak speed, the TaskForce hardware system incorporates highly resilient and high-capacity components. These include a server-grade motherboard, an 8-thread Xeon CPU at 3.7 GHz, and ECC RAM. The credibility and effectiveness of our tools are ensured through extensive testing on hundreds of different storage devices.
This hardware unit is engineered to accommodate a broad spectrum of digital investigations and can function both in a laboratory setting and in standalone mode.
Port Specification, Indicators & Controls
Ports included:
- 6 SATA
- 6 SATA/SAS
- 4 USB
- IDE
- Extension slot (compatible with Thunderbolt, Apple PCIe SSD, and M.2 SSD extension modules)
There is a source/target switch on each of the 18 ports, which activates hardware write protection in source mode. This mode aids in securely connecting the drives under examination to TaskForce. The configuration of the TaskForce port is adaptable to your needs, serving as either a source or target. LED indicators are present for each port. A specific indicator lights up when the source mode is enabled.
The unit is equipped with two 10Gb Ethernet ports:
- In the lab, it can manage over 12 multiple imaging sessions via two 10Gb network connections.
- In the field, it collaborates efficiently with modern, portable NAS solutions.
- Other ports include Serial RS232, IDE power, VGA, RS-232, DC IN 24V.
The hardware unit supports hard drive interfaces like SATA I/II/III, SAS3 (12Gb), USB 2.0/3.0, and IDE.
TaskForce also accommodates flash card support via a card reader attached to any of its USB ports.
Display Specifications
The primary display is the Microsoft Surface Pro 7/6/4 featuring a 12.3" PixelSense Display, a resolution of 2736 x 1824 (267 PPI), and 10-point multi-touch capabilities. The display can be detached from TaskForce if needed. Additionally, there is an OLED IP display (20x2 characters).
Physical / Environmental Specifications
Encased in aluminum, the unit has dimensions (including the screen) of 12x10x3 inches and a weight (including screen) of 4.5 lbs. The acceptable temperature range for operation is 0°C – 40°C for TaskForce and 0° – 35°C for the screen. Power consumption averages at 60 Watt, with a peak of 280 Watt. The supply voltage ranges from 100 - 240 VAC at a frequency of 50 - 60 Hz.
Additional Specifications
Internally, the hardware unit runs on Linux, operating a custom kernel. The control interface is a web-based TaskForce application. The unit comes with a removable NVMe SSD for managing internal case databases. An optional WiFi 802.11n 150 Mb/s adapter in access point mode for easy connectivity is available for purchase separately.
Forensic Hardware Unit Components
At its core, the TaskForce forensic hardware unit is a compact server-grade computer operating on Linux. But since neither BIOS nor the Linux kernel was originally designed to manage hard disk failures, Atola engineers have dedicated significant R&D to develop a customized, fine-tuned Linux kernel. This customized kernel overcomes these issues, handling damaged media effectively, and includes:
- High-speed DMA data transfers, at 500+ MB/s.
- Complete low-level control over SATA, USB, and IDE ports.
- Full native SATA support.
- Reset and SATA PHY control for the best handling of severely damaged hard drives.
- All BIOS and standard kernel functions are disabled.
Furthermore, TaskForce hardware incorporates Atola's unique circuitry for advanced drive power control:
- Current sensor for in-depth hard disk diagnosis.
- Automatic overcurrent and short-circuit protection.
- Overvoltage protection.
These features are crucial for the correct handling of damaged drives.
For example, low-level control of the SATA, SAS, USB, and IDE ports enables TaskForce to manage devices that do not properly initialize, have many bad sectors, or frequently freeze due to internal (mechanical) failures. SATA PHY control permits a frozen hard drive reset without a power cycle, thus saving time during imaging and reducing the risk of further hard disk degradation and failure. Current sensing allows TaskForce to diagnose a failed drive, even if it has electronic or mechanical damage.
Overcurrent protection identifies when the drive draws abnormal current and prevents further damage. The overvoltage protection circuit ensures that in the rare event of forensic hardware malfunction, the attached drives remain undamaged.
TaskForce hardware forensic unit is entirely controlled by software through the Chrome browser; hence, no Linux experience is needed to operate it.
Magnetic Screen Protector
The screen protector safeguards the TaskForce screen from physical damage during transit and facilitates rapid and easy packing of the unit.
Crafted from 2-mm thick aluminum, it is sturdy enough to protect the screen from scratches and breaks, yet lightweight and thin to avoid adding extra bulk to the device.
Five magnetic screws on TaskForce's upper panel facilitate swift and easy attachment of the lid. It can be removed just as easily with a careful pull.
This cover is included in the standard package with TaskForce's assembled from September 2020 onwards. Customers with an active TaskForce subscription can request the complimentary cover by contacting our support and providing their unit's serial number and shipping address.
Please note that the only magnetic parts used are the magnetic screws. Although our tests have proven that they do not damage a drive, we advise against placing storage or other devices near the magnets.
Extension Modules
TaskForce is a cutting-edge hardware unit designed to be versatile and adaptable. With the ever-evolving world of technology, the need for compatibility with various drive interfaces is paramount. Enter the world of hardware add-ons, which expand the capabilities of TaskForce.
The Role of the PCI Express Port
At the heart of this adaptability is the PCI Express port located on the back panel of the TaskForce unit. This port, known as the Extension port, is the gateway to plugging in Atola hardware extension modules. These modules are fully supported by the Atola TaskForce software, ensuring seamless integration and operation.
Benefits of Using Extension Modules
Why go for extension modules? Think of them as the bridge between TaskForce and a myriad of drive interfaces. They ensure that TaskForce remains relevant, adaptable, and ahead of the curve. Plus, with the ease of plug-and-play, you're always ready for what's next.
Supported TaskForce Operations
For these drives, TaskForce offers:
- Write protection
- Diagnostics (with detailed reports for M.2 NVMe drives)
- Imaging
- Hash calculation
- Support for damaged drives
Apple PCIe SSD Extension Module
Apple enthusiasts, this one's for you! This extension is tailored for PCIe SSDs with Apple's custom proprietary M.2 interface.
Compatibility with Apple Laptops
- MacBook Pro, Late 2013-2015
- MacBook Air, 2013-2015
Frequently Asked Questions
Q: Is the TaskForce hardware system compatible with both Windows and Mac operating systems?
A: Yes, the TaskForce hardware system seamlessly integrates with both Windows and Mac operating systems, ensuring versatile functionality in different forensic environments.
Q: Can TaskForce support multiple imaging sessions simultaneously?
A: Yes, TaskForce is engineered to facilitate multiple simultaneous imaging sessions, enhancing its efficiency in handling complex forensic tasks.
Q: How can I obtain the magnetic screen protector?
A: Customers with an active TaskForce subscription can acquire the complimentary magnetic screen protector by reaching out to our support team with their unit's serial number and shipping address.
Q: Are there any precautions concerning the magnetic parts used in TaskForce?
A: Though the magnetic screws used in TaskForce have been tested and confirmed not to harm drives, as a precaution, we recommend not placing storage or other devices near the magnets.
Q: Can TaskForce manage severely damaged hard drives?
A: Yes, TaskForce incorporates a customized Linux kernel and proprietary circuitry that empower it to handle severely damaged hard drives, including those with bad sectors or mechanical failures.
